c7a300b922
Some checks failed
CI / lint-and-test (pull_request) Successful in 1m21s
CI / ansible-validation (pull_request) Successful in 9m3s
CI / secret-scanning (pull_request) Successful in 3m19s
CI / dependency-scan (pull_request) Successful in 7m13s
CI / sast-scan (pull_request) Successful in 6m38s
CI / license-check (pull_request) Successful in 1m16s
CI / vault-check (pull_request) Failing after 6m40s
CI / playbook-test (pull_request) Successful in 9m28s
CI / container-scan (pull_request) Successful in 7m59s
CI / sonar-analysis (pull_request) Failing after 1m11s
CI / workflow-summary (pull_request) Successful in 1m11s
- Add roles/pote: Python/venv deployment role with PostgreSQL, cron jobs - Add playbooks/app/: Proxmox app stack provisioning and configuration - Add roles/app_setup: Generic app deployment role (Node.js/systemd) - Add roles/base_os: Base OS hardening role - Enhance roles/proxmox_vm: Split LXC/KVM tasks, improve error handling - Add IP uniqueness validation: Preflight check for duplicate IPs within projects - Add Proxmox-side IP conflict detection: Check existing LXC net0 configs - Update inventories/production/group_vars/all/main.yml: Add pote project config - Add vault.example.yml: Template for POTE secrets (git key, DB, SMTP) - Update .gitignore: Exclude deploy keys, backup files, and other secrets - Update documentation: README, role docs, execution flow guides Security: - All secrets stored in encrypted vault.yml (never committed in plaintext) - Deploy keys excluded via .gitignore - IP conflict guardrails prevent accidental duplicate IP assignments
56 lines
1.6 KiB
YAML
56 lines
1.6 KiB
YAML
---
|
|
# Proxmox VM defaults based on your current setup
|
|
vm_name: "ansible-control"
|
|
vm_id: 110
|
|
vm_memory: 8192 # 8GB (match current successful setup)
|
|
vm_cores: 2 # 2 cores (perfect for Ansible)
|
|
vm_sockets: 1
|
|
vm_disk_size: 20G # Increase from current 6.1GB
|
|
vm_storage: "local-lvm"
|
|
vm_network_bridge: "vmbr0"
|
|
vm_os_type: "l26" # Linux 2.6+ kernel
|
|
|
|
# Ubuntu Server ISO
|
|
vm_iso: "ubuntu-24.04-live-server-amd64.iso"
|
|
vm_iso_storage: "local"
|
|
|
|
# Cloud-init settings
|
|
vm_ciuser: "master"
|
|
vm_cipassword: "" # Set in vault: vault_vm_cipassword
|
|
vm_ssh_keys: [] # Add SSH public keys
|
|
vm_ip_config: "dhcp" # or "192.168.1.100/24,gw=192.168.1.1"
|
|
vm_nameservers: "8.8.8.8 8.8.4.4"
|
|
|
|
# VM behavior
|
|
vm_start_after_create: true
|
|
vm_enable_agent: true
|
|
vm_boot_order: "order=scsi0"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Proxmox LXC defaults (used when proxmox_guest_type == 'lxc')
|
|
# -----------------------------------------------------------------------------
|
|
lxc_vmid: 300
|
|
lxc_hostname: "app-container"
|
|
lxc_ostemplate: "local:vztmpl/debian-12-standard_12.7-1_amd64.tar.zst"
|
|
lxc_storage: "local-lvm"
|
|
lxc_network_bridge: "vmbr0"
|
|
lxc_ip: "" # e.g. "10.0.10.101/24"
|
|
lxc_gateway: "" # e.g. "10.0.10.1"
|
|
lxc_nameserver: "1.1.1.1 8.8.8.8"
|
|
|
|
lxc_unprivileged: true
|
|
# Use list form because community.proxmox.proxmox expects list for `features`
|
|
lxc_features_list:
|
|
- "keyctl=1"
|
|
- "nesting=1"
|
|
|
|
lxc_cores: 2
|
|
lxc_memory_mb: 2048
|
|
lxc_swap_mb: 512
|
|
lxc_rootfs_size_gb: 16
|
|
|
|
# Add to /root/.ssh/authorized_keys (bootstrap). Override with appuser_ssh_public_key.
|
|
lxc_pubkey: ""
|
|
|
|
lxc_start_after_create: true
|